The lastlog should provide the information you want. Be careful about taking action against a user just because he appeared in two places at once. Some users may ssh from one machine to another or run X11 terminals over the network. Either of these would cause them to be logged on in multiple places at one time. You can filter out these false positives by examining whether the login occurred on the physical terminal or remotely.